So I have an application in centos that monitors process creation and sends it to a remote syslog server which is also running the Universal Forwarder. The syslog is then forwarded to Splunk and I split it using the pipe "|" delimiter. However, I found that many applications like awk and sed use "|" to filter which also messes up the field separation in splunk. Does anyone know how to work around this?
This is when I'm in search.
Thanks
